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Abstract 


This document describes the Security Evaluated Standardized Password- 
Authenticated Key Exchange (SESPAKE) protocol. The SESPAKE protocol 
provides passvord-authenticated key exchange for usage in systems for 
protection of sensitive information. The security proofs of the 
protocol vere made for situations involving an active adversary in 
the channel, including man-in-the-middle (MitM) attacks and attacks 
based on the impersonation of one of the subjects. 


Status of This Memo 


This document is not an Internet Standards Track specification, it is 
published for informational purposes. 


This is a contribution to the RFC Series, independently of any other 
RFC stream. The RFC Editor has chosen to publish this document at 
its discretion and makes no statement about its value for 
implementation or deployment. Documents approved for publication by 
the RFC Editor are not a candidate for any level of Internet 
Standard, see Section 2 of RFC 7841. 


Information about the current status of this document, any errata, 
and hov to provide feedback on it may be obtained at 
http://vvv.rfc-editor.org/info/rfc8133. 


Copyright Notice 


Copyright (c) 2017 IETF Trust and the persons identified as the 
document authors. All rights reserved. 


This document is subject to BCP 78 and the IETF Trust” s Legal 
Provisions Relating to IETF Documents 
(http://trustee.ietf.org/license-info) in effect on the date of 
publication of this document. Please reviev these documents 
carefully, as they describe your rights and restrictions vith respect 
to this document. 
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1. Introduction 


This document describes the Security Evaluated Standardized Password- 
Authenticated Key Exchange (SESPAKE) protocol. The SESPAKE protocol 
provides passvord-authenticated key exchange for usage in systems for 
protection of sensitive information. The protocol is intended to be 
used to establish keys that are then used to organize a secure 
channel for protection of sensitive information. The security proofs 
of the protocol were made for situations involving an active 
adversary in the channel, including man-in-the-middle (MitM) attacks 
and attacks based on the impersonation of one of the subjects. 


2. Conventions Used in This Document 
The key words "MUST", "MUST NOT", "REOUIRED", "SHALL", "SHALL NOT", 


"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 
document are to be interpreted as described in [RFC2119]. 
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3. Notations 


This document uses the folloving parameters of elliptic curves in 
accordance with [RFC6090]: 


E an elliptic curve defined over a finite prime field GF(p), 
where p > 3, 


p the characteristic of the underlying prime field, 


a, b the coefficients of the equation of the elliptic curve in the 
canonical form, 


m the elliptic curve group order, 

q the elliptic curve subgroup order, 

P a generator of the subgroup of order q; 

X, Y the coordinates of the elliptic curve point in the canonical 
form; 

O zero point (point at infinity) of the elliptic curve. 


This memo uses the following functions: 
HASH the underlying hash function; 


HMAC the function for calculating a message authentication code 
(MAC), based on a HASH function in accordance with [RFC2104], 


F(PW, salt, n) 
the value of the function PBKDF2 (PW, salt, n, len), where 
PBKDF2 (PW, salt, n, len) is calculated according to 
[RFC8018]. The parameter len is considered equal to the 
minimum integer that is a multiple of 8 and satisfies the 
following condition: 


len >= floor(log_2(q)). 
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This document uses the folloving terms and definitions for the sets 
and operations on the elements of these sets: 


Bn the set of byte strings of size n, n >= 0; for n = 0, the B n 
set consists of a single empty string of size 0; if b is an 
element of B n, then b = (b 1,...,b n), where b 1,...,b n are 


elements of (0,...,255); 


| | concatenation of byte strings A and C, i.e., if A in B nl, 
C in B_n2, A = (a 1,a 2,...,a nl) and C = (c 1,c 2,...,c.n2), 
then A | | G = (a-l,;a.25..5.,;a niye 176-226 pd n2) Ts van 
element of B (nl + n2), 


int (A) for the byte string A = (a 1,...,a n) in B n, an integer 
int (A) = 256“(n - 1)a n +...+ 256^(0)a 1; 
bytes n(X) 
the byte string A in B n, such that int(A) — X, where X is an 


integer and 0 <= X € 2560n; 


BYTES (0) 
for Q in E, the byte string bytes n(X) | | bytes_n(Y), where 
X, Y are standard Weierstrass coordinates of point Q and 
n = ceil(log (1256) (p)). 


4. Protocol Description 


The main point of the SESPAKE protocol is that parties sharing a weak 
key (a password) generate a strong common key. An active adversary 
who has access to a channel is not able to obtain any information 
that can be used to find a key in offline mode, i.e., without 
interaction with legitimate participants. 


The protocol is used by subjects A (client) and B (server) that share 
some secret parameter that was established in an out-of-band 
mechanism: a client is a participant who stores a password as a 
secret parameter, and a server is a participant who stores a 
password-based computed point of the elliptic curve. 


The SESPAKE protocol consists of two steps: the key-agreement step 
and the key-confirmation step. During the first step (the 
key-agreement step), the parties exchange keys using Diffie-Hellman 
with public components masked by an element that depends on the 
password -- one of the predefined elliptic curve points multiplied by 
the password-based coefficient. This approach provides an implicit 
key authentication, which means that after this step, one party is 
assured that no other party, aside from a specifically identified 
second party, may gain access to the generated secret key. During 
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the second step (the key-confirmation step), the parties exchange 
strings that strongly depend on the generated key. After this step, 
the parties are assured that a legitimate party, and no one else, 
actually has possession of the secret key. 


To protect against online guessing attacks, counters that indicate 
the number of failed connections vere introduced in the SESPAKE 
protocol. There is also a special technique for small-order point 
processing and a mechanism that provides protection against 
reflection attacks by using different operations for different sides. 


4.1. 


Protocol Parameters 


Various elliptic curves can be used in the protocol. For each 
elliptic curve supported by clients, the folloving values MUST be 
defined: 


o 


the protocol parameters identifier, ID ALG (which can also define 
a HASH function, a pseudorandom function (PRF) used in the PBKDF2 
function, etc.), vhich is a byte string of an arbitrary length, 


the point P, which is a generator point of the subgroup of order q 
of the curve, 


the set of distinct curve points (Q 1,0 2,...,0.N) of order q, 
vhere the total number of points, N, is defined for the protocol 
instance. 


The method of generation of the points (Q 1,0 2,...,0 N} is described 
in Section 5. 


The following protocol parameters are used by subject A: 


1 


The secret password value PW, which is a byte string that is 
uniformly randomly chosen from a subset of cardinality 10^10 or 
greater of the set B k, where k »- 6 is the password length. 


The list of curve identifiers supported by A. 


Sets of points (Q 1,0 2,...,0 N}, corresponding to curves 
supported by A. 


The C 1^A counter, which tracks the total number of unsuccessful 
authentication trials in a row, and a value of CLim 1 that stores 
the maximum possible number of such events. 
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The 


The C 2%A counter, which tracks the total number of unsuccessful 
authentication events during the period of usage of the specific 
PW, and a value of CLim 2 that stores the maximum possible number 
Of such events. 


The C 3%A counter, which tracks the total number of 
authentication events (successful and unsuccessful) during the 
period of usage of the specific PW, and a value of CLim 3 that 
stores the maximum possible number of such events. 


The unique identifier, ID A, of subject A (OPTIONAL), which is a 
byte string of an arbitrary length. 


following protocol parameters are used by subject B: 


The values ind and salt, vhere ind is in (1,...,N) and salt is in 
Lys vá 2212821.) 


The point Q PW, satisfying the following equation: 
Q PW = int (F(PW, salt, 2000))”Q ind. 


It is possible that the point Q PW is not stored and is 
calculated using PW in the beginning of the protocol. In that 
case, B has to store PW and points (0 1,0 2,...,0.N). 


The ID ALG identifier. 


The C 1^B counter, which tracks the total number of unsuccessful 
authentication trials in a rov, and a value of CLim 1 that stores 
the maximum possible number of such events. 


The C 2%B counter, which tracks the total number of unsuccessful 
authentication events during the period of usage of the specific 
PW, and a value of CLim 2 that stores the maximum possible number 
of such events. 


The C 3^B counter, which tracks the total number of 
authentication events (successful and unsuccessful) during the 
period of usage of the specific PW, and a value of CLim 3 that 
stores the maximum possible number of such events. 


The unique identifier, ID B, of subject B (OPTIONAL), which is a 
byte string of an arbitrary length. 
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4.2. Initial Values of the Protocol Counters 


After the setup of a new password value PW, the values of the 
counters MUST be assigned as follows: 


o C 1^A 


C 1%B 


CLim 1, where CLim 1 is in {3,...,5}; 
o C 2%A = C 2”B = CLim 2, where CLim 2 is in (7,...,20); 


o: (OSA 


(«3^ B 


CLim 3, where CLim 3 is in {10%3,10%3+1,...,10%5}. 
4.3. Protocol Steps 


The basic SESPAKE steps are shown in the scheme below: 


4 — — — — — — — — — — — — — — — — — — — — — — — — — — -- — — — — — — —— + 
| A [A ID, PW] B [B ID, O PW, ind, salt] | 
4 — — — — — — — — — — — — — — — — — — — — — — — — — — -- — — — — — — —— + 
if C 1^A or C 2^A or 
C 3^A = 0 ==> quit 
decrement C 1^A, C 2^A, A ID ---> if C 1^B or C 2^B or 
C 3^A by 1 
z A = 0 <——— decrement C 1”B, C 2%B, 
ID ALG, C 3^B by 1 
B ID 
(OPTIONAL), 


+ 

| 

+ 

| 

| 

| 

| 

| 

| ind, salt 

Q PW*A = int (F(PW, salt, 

2000))*Q ind 

choose alpha randomly | 
| 
| 
| 
| 
| 
| 
| 
| 
| 


+ 
| 
+ 
| 
| 
| 
| C 3^B = 0 ==> quit 
| 
| 
| 
| 

from {1,...,q-1} 

| 

| 


u 1 = alpha*P - Q PW^A u 1 ---» if u 1 not in E ——> guit 
O B= u l + O PW 
choose beta randomly from 
11,...,q-1) 
if m/q*Q B = O ==> Q B= 
beta*P, z B = 1 
KB = 
HASH (BYTES ( ( m/q*beta* 
(mod q))*Q B )) 
if u 2 not in E ——> quit u 2 = beta*P + Q PW 


O A = u 2 - Q PW^A 
if m/q*Q A = O ==> QA = 
alpha*P, Z A = 1 
K A = HASH(BYTES(( m/q” 
alpha (mod q))”Q A )) 


| 
| 
| 
| 
| 
| 
| 
| 
z B- 0 | 
| 
| 
| 
| 
| 
| 
| 


A 
| 
| 
c 
M 
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| U 1 = BYTES(u 1), U2 = | | 
| BYTES (u_2) | | | 
| MAC A — HMAC(K A, 0x01 DATA A, | U 1 — BYTES(u 1), U 2 - | 
|| IDA İl ind | salt MAC A ---» BYTES (u 2) 
| va İl u 2 || mae | | | 
İ (OPTIONAL) || DATA A) | | | 
| | | if MAC A != HMAC(K B, | 
| | | oxor |] mo || ina İl | 
| | | salt || u1 || u2 | | 
ID ALG (OPTIONAL) 
| | | DATA_A) ==> quit | 
| | | if z B = 1 ==> quit | 
| | | C 1^B = CLim 1, increment | 
| | | C 2^B by 1 | 
| if MAC B !- HMAC(K A, | «--- | MAC B - HMAC(K B, 0x02 || | 
0x02 E ID Ti m. ind || DATA B, ID B ind salt || 
salt 1 || u2 | MAC B U 1 U 2 ID ALG 
| ID_ALG ıl, | | | | (OPTIONAL) || DATA A || | 
| DATA A İİ DATA B) ==> | | DATA_B) 
| guit | | | 
| if Z A = 1 ==> quit | | 
C 1^A = CLim 1, 
increment C 2^A by 1 
4R--------2------------------ 4R------------ 4— — — — — — — — — — — — — — — — — — — — — — ———— — + 


Table 1: SESPAKE Protocol Steps 
The full description of the protocol consists of the following steps: 


1; If any of the counters C 1^A, C 2%A, or C 3%A is equal to 0, A 
finishes the protocol with an informational error regarding 
exceeding the number of trials that is controlled by the 
corresponding counter. 


25 A decrements each of the counters C 1^A, C 2^A, and C 3^A by 1, 
requests open authentication information from B, and sends the 
ID A identifier. 


34 If any of the counters C 1^B, C 2^B, or C 3^B is equal to 0, B 
finishes the protocol with an informational error regarding 
exceeding the number of trials that is controlled by the 
corresponding counter. 


4s B decrements each of the counters C 1^B, C 2^B, and C 3^B by 1. 
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De B sends the values of ind, salt, and the ID ALG identifier to A. 
B also can OPTIONALLY send the ID B identifier to A. All 
subsequent calculations are done by B in the elliptic curve 
group defined by the ID ALG identifier. 


6. A sets the curve defined by the received ID ALG identifier as 
the used elliptic curve. All subsequent calculations are done 
by A in this elliptic curve group. 


Tz A calculates the point © PW*A = int (F(PW, salt, 2000))*Q_ind. 


8. A chooses randomly (according to the uniform distribution) the 
value alpha; alpha is in {1,...,q-1}; then A assigns z A = 0. 


9. A sends the value u 1 = alpha*P - Q PW^A to B. 


10. After receiving u 1, B checks to see if u 1 is in E. If it is 
not, B finishes vith an error and considers the authentication 
process unsuccessful. 


11. B calculates QB = u 1 + Q PV, assigns z B = 0, and chooses 
randomly (according to the uniform distribution) the value beta, 
beta is in Aly cs Gal}. 


12. If m/q*Q_B = O, B assigns Q B = beta*P and z B = 1. 


13. B calculates K B = HASH(BYTES(( m/q*beta* (mod q))*Q B )). 


14. B sends the value u 2 — beta”P + Q PW to A. 
15. After receiving u 2, A checks to see if u 2 is in E. If it is 
not, A finishes vith an error and considers the authentication 


process unsuccessful. 


16. A calculates Q A = u 2 — Q PW^A. 


17. If m/q*Q_A = O, then A assigns Q A = alpha*P and z A = 1. 


18. A calculates K A = HASH(BYTES(( m/q”alpha (mod g)) MO A )). 


19. A calculates U 1 — BYTES(u 1), U 2 — BYTES(u 2). 

20. A calculates MAC A = HMAC(K A, 0x01 || IDA || ind || salt || 
U 1 || U 2 || ID ALG (OPTIONAL) || DATA A), where DATA A is an 
OPTIONAL string that is authenticated with MAC A (if it is not 
used, then DATA A is considered to be of zero length). 


21. A sends DATA A, MAC A to B. 
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22. 


23. 


24. 


25. 


26. 


2h» 


28. 


29. 


30. 


B calculates U 1 = BYTES(u 1), U 2 = BYTES (u 2). 


B checks to see if the values MAC A and HMAC(K B, 0x01 İİ ID A 
|| ind İl salt İl U 1 || U 2 || ID ALG (OPTIONAL) || DATA A) are 
equal. If they are not, it finishes with an error and considers 


the authentication process unsuccessful. 


If z B — 1, B finishes vith an error and considers the 
authentication process unsuccessful. 


B sets the value of C 1%B to CLim 1 and increments C 2”B by 1. 


B calculates MAC B = HMAC(K B, 0x02 || ID B || ind || salt || 
U 1 || u 2 || ID ALG (OPTIONAL) || DATA A İİ DATA B), where 
DATA B is an OPTIONAL string that is authenticated with MAC B 
(if it is not used, then DATA B is considered to be of zero 
length). 


B sends DATA B, MAC B to A. 


A checks to see if the values MAC B and HMAC(K A, 0x02 || ID B 
|| ina || salt İl U 1 || U 2 İİ ID ALG (OPTIONAL) || DATA A || 
DATA B) are equal. If they are not, it finishes with an error 


and considers the authentication process unsuccessful. 


If Z A — 1, A finishes with an error and considers the 
authentication process unsuccessful. 


A sets the value of C 1%A to CLim 1 and increments C 2%A by 1. 


After the procedure finishes successfully, subjects A and B are 
mutually authenticated, and each subject has an explicitly 
authenticated value of K = KA = KB. 


Notes: 


In cases where the interaction process can be initiated by any 
subject (client or server), the ID A and ID B options MUST be 
used, and the receiver MUST check to see if the identifier he had 
received is not equal to his own; otherwise, it finishes the 
protocol. If an OPTIONAL parameter ID_A (or ID_B) is not used in 
the protocol, it SHOULD be considered equal to a fixed byte 
string (a zero-length string is allowed) defined by a specific 
implementation. 
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2. The ind, ID A, ID B, and salt parameters can be agreed upon in 
advance. lf some parameter is agreed upon in advance, it is 
possible not to send it during a corresponding step. 
Nevertheless, all parameters MUST be used as corresponding inputs 
to the HMAC function during Steps 20, 23, 26, and 28. 


3. The ID ALG parameter can be fixed or agreed upon in advance. 


4. It is RECOMMENDED that the ID ALG parameter be used in HMAC 
during Steps 20, 23, 26, and 28. 


5. Continuation of protocol interaction in a case where any of the 
counters C 1^A or C 1^B is equal to zero MAY be done without 
changing the password. In this case, these counters can be used 
for protection against denial-of-service attacks. For example, 
continuation of interaction can be allowed after a certain delay 
period. 


6. Continuation of protocol interaction in a case where any of the 
counters C 2^A, C 3%A, C 2%B, or C 3^B is equal to zero MUST be 
done only after changing the passvord. 


7. 1t is RECOMMENDED that during Steps 9 and 14 the points u 1 and 
u 2 be sent in a non-compressed format (BYTES(u 1) and 
BYTES(u.2)). Hovever, point compression MAY be used. 


8. The use of several Q points can reinforce the independence of the 
data streams vhen vorking vith several applications — for 
example, when two high-level protocols can use two different 
points. However, the use of more than one point is OPTIONAL. 


5. Construction of Points (Q 1,..., 0 N} 


This section provides an example of a possible algorithm for the 
generation of each point Q i in the set (Q 1,...,Q N) that 
corresponds to the given elliptic curve E. 


The algorithm is based on choosing points with coordinates with known 
preimages of a cryptographic hash function H, which is the 

GOST R 34.11-2012 hash function (see [RFC6986]) with 256-bit output 
if 20254 € q € 27256, and the GOST R 34.11-2012 hash function (see 
İRFC69861) with 512-bit output if 27508 c q € 27512. 
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The algorithm consists of the folloving steps: 


1. Set i — 1, SEED — 0, s — 4, 


2. Calculate X = int (HASH(BYTES(P) || bytes s(SEED))) mod p. 

3. Check to see if the value of X”3 + aX + b is a quadratic residue 
in the field F p. If it is not, set SEED = SEED + 1 and return 
to Step 2. 

4. Choose the value of Y = min{rl, r2), where rl, r2 from 
(0,1,...,p-1) are such that rl != r2 and r12 = r2^2 = R mod p 


for R = X”3 + aX + b. 


5. Check to see if the folloving relations hold for the point 
Q = (X, Y): Q != O and ggo = O. If they do, go to Step 6; if 
not, set SEED — SEED + 1 and return to Step 2. 


6. Set Qi = Q, If i < N, then set i = i + 1 and go to Step 2; 
othervise, finish. 


With the defined algorithm for any elliptic curve E, point sets 
(0 1,...,0 N} are constructed. Constructed points in one set MUST 
have distinct X-coordinates. 


Note: The knovledge of a hash function preimage prevents knovledge of 
the multiplicity of any point related to generator point P. It is of 
primary importance, because such knovledge could be used to implement 
an attack against the protocol vith an exhaustive search for the 
passvord. 
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6. 


Security Considerations 


Any cryptographic algorithms -- particularly HASH functions and HMAC 
functions -- that are used in the SESPAKE protocol MUST be carefully 
designed and MUST be able to withstand all known types of 
cryptanalytic attacks. 


It is RECOMMENDED that the HASH function satisfy the following 
condition: 


o hashlen <= log_2(q) + 4, where hashlen is the length of the HASH 
function output. 


It is RECOMMENDED that the output length of hash functions used in 
the SESPAKE protocol be greater than or equal to 256 bits. 


The points (Q 1,0 2,...,0 N} and P MUST be chosen in such a way that 
they are provably pseudorandom. As a practical matter, this means 
that the algorithm for generation of each point Q_i in the set 
{Q_1,...,Q_N} (see Section 5) ensures that the multiplicity of any 
point under any other point is unknown. 


Using N = 1 is RECOMMENDED. 
Note: The specific adversary models for the protocol discussed in 


this document can be found in [SESPAKE-SECURITY], which contains the 
security proofs. 


IANA Considerations 


This document does not require any IANA actions. 
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Appendix A. Test Examples for GOST-Based Protocol Implementation 


A. 


A. 


The folloving test examples are made for the protocol implementation 
that is based on the Russian national standards GOST R 34.10-2012 
[GOST3410-2012] and GOST R 34.11-2012 [GOST3411-2012]. The English 
versions of these standards can be found in [RFC7091] and [RFC6986]. 


1. Examples of Points 


There is one point Q 1 for each of the elliptic curves belov. These 
points vere constructed using the method described in Section 5 for 
N = 1 and the GOST R 34.11-2012 hash function (see [RFC6986]). If 
20254 < q < 27256, the GOST R 34.11-2012 hash function with 256-bit 
output is used, and if 27508 < q < 27512, the GOST R 34.11-2012 hash 
function vith 512-bit output is used. 


Each of the points complies vith the GOST R 34.10-2012 
[GOST3410-2012] standard and is represented by a pair of (X, Y) 
coordinates in the canonical form and also by a pair of (U, V) 
coordinates in the twisted Edvards form in accordance with [RFC7836] 
for the curves that have equivalent representations in this form. 
There is a SEED value for each point, by vhich it vas generated. 


id-GostR3410-2001-CryptoPro-A-ParamSet, 
id-GostR3410-2001-CryptoPro-B-ParamSet, etc. are defined in 
İRFC43571. id-tc26-gost-3410-2012-512-paramSetA, 
id-tc26-gost-3410-2012-512-paramSetB, etc. are defined in [RFC7836]. 


1.1. Curve id-GostR3410-2001-CryptoPro-A-ParamSet 


Point Q 1 

X = ÜUxa69d51cafla309fa9e9b66187759b0174c274e6080356f23cfcbfe844396ad7bb 
Y = 0x5d26f29ecc2e9ac0404dcf7986fa55fe94986362170f54b9616426a659786dac 
SEED = 0x0001 


.1.2. Curve id-GostR3410-2001-CryptoPro-B-ParamSet 


Point Q 1 

X = 0x3d715a874a4b17cb3b517893a9794a2b36c89d2ffc693f01ee4cc27e7£49e399 
Y = Üxlc5a641fcf7ceTYe87cdfS8cea38f3db3096ecace2fad158384b53953365f4feT7fe 
SEED = 0x0000 


.1.3. Curve id-GostR3410-2001-CryptoPro-C-ParamSet 


Point Q 1 

X = 0xle36383e43bb6cfa2917167d71b7b5dd3d6d462b43d7c64282ae67dfbec2559d 
Y = 0x137478a9f721c73932ea06b45cf72e37eb78a63f29a542e563c614650c8b6399 
SEED = 0x0006 
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A, 


A. 


1.4. Curve id-tc26-gost-3410-2012-512-paramSetA 


Point Q 1 

X = 0x2a17f8833432795327478871b5c5e88aefb91126c64b4b8327289bea 62559425 
d18198£133£400874328b220c74497cd240586cb249e158532cb8090776cd6lc 

Y = Üx728f0c4a73b48da41ce928358fad26b47a6e094e9362bae82559f83cddc4ec3a 
4676bd3707edeaf4cd85e99695c64c24ledc622be87dc0cf87f51£4367£723c5 

SEED = 0x0001 


«1.5. Curve id-tc26-gost-3410-2012-512-paramSetB 


Point Q 1 

X = 0Ox7elfae8285e035bec244bef2d0e5ebf436633cf50e55231dea9c9cf21d4c8c33 
df85d4305de92971f0a4b4c07e00d87bdbc720eb66e49079285aaf12e0171149 

Y = 0x2cc8999850875d4463805ba0d858a196592db20ab161558ff2f4ef7a85725d209 
53967ae621afdeae89bb77c83a2528ef6fce02£685bda4679d7£2704947dbc408 

SEED = 0x0000 


.1.6. Curve id-tc26-gost-3410-2012-256-paramSetA 


Point Q 1 

X = Üxb5ladf93a40ab15792164fad3352f95b66369eb2a4ef5efae32829320363350e 
Y = 0x74a358cc08593612f5955d249c96afb7e8b0bb6d8bd2bbe491046650d822be18 
U Oxebe97afffe0d0f88b8b0114b8de430ac2b34564e4420af24728e7305bc48aeaa 
V = 0x828f2dcf8f06612b4fea4da72ca509c0f76dd37df424ea22bfa6f4f65748c1e4 
SEED = 0x0001 


.1.7. Curve id-tc26-gost-3410-2012-512-paramSetC 


Point Q 1 
X = 0x489c91784602e98f19a803abca319917f37689e5a18965251ce2ff4e8d38b298f 
5ba7470f9e0e713487f96f4a8397b3d09a270c9d4367eb5e0e6561adeeb51581d4 
Y = Üx684ea885aca64eaf1b3fee36c0852a3be3bd8011b0ef18e203ff87028d36eb5bdb 
2c144a0dcc71276542bfd72ca2a43fa4f4939d4a6649a60793c704a8c94e16f18 
0x3a3496f97e96b3849a4fa7db60fd393858bde89958e4beebd05a6b3214216b37c 
9d9a560076e7ea59714828b18fbfef996ffc98bf3dc9f2d3cb0ed36a0d6ace88 
V = 0x52d884c8bf0ad6c5f703973e32a668daalfled092eff138dae6203b2ccdec561 
47464435fec4b727b2480eb143074712c76550c7a54ff3ea26f70059480d3cb50 
SEED = 0x0013 


U 


2. Test Examples of SESPAKE 


This protocol implementation uses the GOST R 34.11-2012 hash function 
(see [RFC6986]) with 256-bit output as the H function and the 
HMAC_GOSTR3411_2012_512 function defined in [RFC7836] as a PRF for 
the F function. The parameter len is considered equal to 256 if 
20254 < q € 2^256, and equal to 512 if 27508 < q < 27512. 
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The test examples for the point of each curve in Appendix A.1 are 
given belov. 

A.2.1. Curve id-GostR3410-2001-CryptoPro-A-ParamSet 


The input protocol parameters in this example take the folloving 
values: 


00 00 00 00 

00 00 00 00 

31 32 33 34 35 36 (123456!) 

29 23 BE 84 El 6C D6 AE 52 90 49 F1 F1 BB E9 EB 


X = OxA69D51CAF1A309FA9E9B66187759B0174C274E080356F23CFCBFE84D396AD7BB 
Y = 0x5D26F29ECC2E9AC0404DCF7 98 6FA55FE94986362170F54B9616426A659786DAC 


The function F(PW, salt, 2000) takes the following values: 
F(PW, salt, 2000): 


BD 04 67 3F 71 49 B1 8E 98 15 5B DI EZ 72 4E 71 
DO 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67 


The coordinates of the point Q PW are: 


X 
Y 


0x59495655D1E7C7424C622485F575CCF121F3122D274101E8AB734CC9C9A9B45E 
0x48D1C311D33C9B701F3B03618562A4A07A044E3AF31E3999E67B487778B53C62 


During the calculation of u 1 on subject A, the parameter alpha, 
the point alpha*P, and u 1 take the following values: 


alpha=0x1F2538097D5A031FA68BBB43C84D12B3DE47B7061C0D5E24993E0C873CDBA6B3 
alpha*P: 


X = ÜxBBC77CF42DC1E62D06227935379B4AA4D14FEA4F565DDF4CB4FA4D31579F9676 

Y = 0x8E16604A4AFDF28246684D4996274781F6CB80ABBBA1414C1513EC988509DABF 
u 1: 

X = 0x204F564383B2A76081B907F3FCA8795E806BE2C2ED228730B5B9E37074229E8D 

Y = OxE84F9E442C61DDE37B601A7F37E7CA11C56183FA071DFA9320EDE3E7521F9D41 
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When processing u 1, calculating the K B key, 


March 2017 


and calculating u 2 on 


subject B, the parameters beta, src, K B — HASH(src), beta”P, and u 2 


take the following values: 


beta=0xDC4 97D 9EF 6324912FD367840EE509A2032AEDB1C0A890D133B45F596FCCBD45D 


Src: 
2E 01 A3 D8 4F DB 7E 94 7B B8 92 
F7 25 D6 40 1A A5 59 D4 1A 67 24 
AO DB A9 31 05 CD DA F4 BF AE A3 
BE B2 97 B6 A1 7F 4F BD 96 DC C7 


1A 62 65 54 92 1D C2 E9 2B 4D D8 
62 E5 62 99 37 3F 06 79 95 35 AD 


o 
© 
M ct 
9 
We 


9B E9 36 3D F5 
F8 D5 F1 8E 2C 
90 6F DD 71 9D 
23 EA 34 72 A9 


D6 7D BE 5A 56 
26 09 JE CA A3 


= 0x6097341C1BE388ES3ETCA2DF47FAB86E2271FD942E5B7BZEB2409E49F742BC29 


0xC81AA48BDBA4CA6FAOEF18B9788AE25FE30857AA681B3942217F9FED151BAB7DO 


Y 
2: 
X = OxDC137A2F1DA4A35AEBCOECBF6D3486DEF8480BFDC752A86DD4F207D7D1910E22D 
Y 


= 0x7532FO0CE99DCC7 72A4D 7 7861DĎAE57C138F 0 7AE 304A 72790 7FBOAAF DB624ED 572 


When processing u 2 and calculating the key on subject A, the K A key 


takes the following values: 


K A: 
1A 62 65 54 92 1D C2 E9 2B 4D D8 
62 E5 62 99 37 3F 06 79 95 35 AD 


The message MAC A = HMAC (K_A, 0x01 
from subject A takes the following 


MAC A: 
23 7A 03 C3 5F 49 17 CE 86 B3 58 
6F 10 8B 2F DD OA A9 E8 10 66 4B 


The message MAC B = HMAC (K_B, 0x02 
from subject B takes the following 


MAC_B: 
9E EO E8 73 3B 06 98 50 80 4D 97 
FF E8 TA 3B 15 1F OA E8 3E A9 GA 


D6 7D BE 5A 56 
26 09 4E CA A3 


|| IDA || ind 
values: 

94 45 Fl 1E 1A 
25 59 60 BS 79 
|| ID B İl ind 


values: 


98. 73- ID:.€D LC 
FB 4F FC 31 E4 
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A.2 


“Zə 


Curve id-GostR3410-2001-CryptoPro-B-ParamSet 


The input protocol parameters in this example take the folloving 


values: 
N = 1 
ind = 1 
IDA 
00 00 00 00 
ID B 
00 00 00 00 
PW: 
31 32 33 34 35 36 ("123456") 
salt 
29 23 BE 84 El 6C D6 AE 52 90 49 F1 F1 BB E9 EB 
Q ind 
X = 0x3D715A874A4B17CB3B517893A9794A2B36C89D2FFC693FO1EE4CC27E7F49E399 
Y = Ox1C5A641FCF7CE7E87CDF8CEA38F3DB3096EACE2FAD158384B53953365F4FETFE 
The function F(PW, salt, 2000) takes the following values: 
F(PW, salt, 2000): 


The 


BD 04 67 3F 71 49 BI 8E 98 15 5B DI E2 72 4E 71 
DO 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67 


coordinates of the point Q PW are: 


X — 


Y 


0x6DC2AE2 6BC691F CASA 7 3D9C452 790D 15E 34BA5404D92955B914C8D2662AB 


B985 


0x3B02AAA9DD65AE30C335CED12F3154BBAC059F66B088306747453EDF6E5DB077 


During the calculation of u 1 on subject A, the parameter alpha, 
the point alpha*P, and u 1 take the following values: 


alpha=0x499D72B90299CABODA1F8BE19D9122F622A13B32B730C46BD0664044F2144FAD 
alpha*P: 
0x61D6F916DB717222D74877F179F7EBEF7CD4D24D8C1F523C048E34A1DF30F8DD 
0x3EC488 6304 9CFCFE662904082E78503F4973A4E105E2F1B18C69A5E7FB209000 


x 


KXMHK 


= Üx21F5437AF33D2A1171A070226B4AE82D3765CDOEEBFFIECEFE158EBC50C63AB1 
0x5C9553B5D11AAAECE738AD 9A9F8CB4C100AD4FA5E08 9D3CBCCEA8C0172EB7ECC 
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When processing u 1, calculating the K B key, and calculating u 2 on 
subject B, the parameters beta, src, K B — HASH(src), beta”P, and u 2 
take the following values: 


beta=0x0F 69FF614957EF83668EDC2D7ED614BE7 6F 7B253DB23C5CC9C52BF7DF8F4669D 
src: 

50 14 OA 5D ED 33 43 EF C8 25 7B 79 E6 46 D9 FO 

DF 43 82 8C 04 91 9B D4 60 C9 TA DI 4B A3 A8 6B 

00 C4 06 B5 74 4D 8E B1 49 DC 8E 7F C8 40 64 D8 

53 20 25 3E 57 A9 B6 Bİ 3D OD 38 FE AB EE SE OA 


A6 26 DE 01 B1 68 OF F7 51 30 09 12 2B CE El 89 
68 83 39 4F 96 03 01 72 45 5C 9A EO 60 CC E4 4A 


o 
© 
M ct 
o 
We 


= Üx33BCöF7E9COBA10CFB2B725466327171295508EA97FSCSBA9F890F2478AB4D6C 
= Üx75D57B396C396F492F057E9222CCC686437A2AAD464E452EF426FCSEEED1A4A6 


Y 
2: 
X = 0x089DDEE718EE8A224A7F37E22CFFD731C25FCBF58860364EE322412CDCEF99AC 
Y = 0x0ECE03D4E395A6354C571871BEF425A532D5D4 63BOF8FD427F91A43E20CDA55C 


When processing u_2 and calculating the key on subject A, the K_A key 
takes the following values: 


K_A: 
A6 26 DE 01 BI 68 OF F7 51 30 09 12 2B CE El 89 
68 83 39 4F 96 03 01 72 45 5C 9A EO 60 CC E4 4A 


The message MAC_A = HMAC(K_A, 0x01 | | ID_A | | ind | | salt | | u 1 | | u_2) 
from subject A takes the following values: 


MAC_A: 
B9 1F 43 90 2A FA 90 D3 E5 C6 91 CB DC 43 SA 1E 
BF 54 7F 4C 2C B4 14 43 CC 38 79 7B E2 47 A7 DO 


The message MAC_B = HMAC(K B, 0x02 || IDB || ind || salt || u 1 || u 2) 
from subject B takes the following values: 


MAC_B: 
79 D5 54 83 FD 99 BI 2B CC A5 ED C6 BB El D7 B9 
15 CE 04 51 BO 89 1E 77 5D 4A 61 CB 16 E3 3F CC 
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A.2. 


3. 


Curve id-GostR3410-2001-CryptoPro-C-ParamSet 


March 2017 


The input protocol parameters in this example take the folloving 
values: 


00 00 00 00 


00 00 00 00 


31 32 33 34 35 36 ("123456") 


29 23 BE 84 El 6C D6 AE 52 90 49 F1 F1 BB E9 EB 


The 


T 


0x1E36383E43BB6CFA2917167D71B7B5DD3D6D462B43D7C64282AE67DFBEC2559D 
0x137478A9F721C73932EA06B45CF72E37EB78A63F29A542E563C614650C8B6399 


function F(PW, salt, 2000) takes the following values: 


F (PW, 


The 


salt, 2000): 


coordinates of the point Q PW are: 


X — 


Y 


0x945821DAF91E158B839939630655A3B21FF3l 


BD 04 67 3F 71 49 B1 8E 98 15 5B DI E2 72 4E 71 
DO 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67 


E146D270411 


E86C05650E 


ER) 


B46B59 


0x3A0C2816AC97421FA0E879605F17F0C9C3EB734CFF196937F6284438D70BDC48 


During the calculation of u 1 on subject A, the parameter alpha, 


the point alpha*P, 


and u 1 take the following values: 


alpha-0x3A54AC3F19AD9DOBIEAC8ACDCEA70E581F1DAC33D13FEAFD81E762378639C1A8 
alpha*P: 
= 0x96B7F09C94D297C257A7DA48364C0076E59E48D221CBA604AE111CA3933B446A 
E091F79592CA202A020D762C34A6 


x 
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KXMHK 


0x54E4953D86B77ECCEB578500931E822300F7] 


= Üx81BBD6FCA464D2E2404A66D786CE4A777E739A89AEB68C2DAC99D53273B75387 
Ox6B6DBD922EA7E060998F8B230AB6EF07AD2EC86B2BF66391D82A30612EADD411 
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When processing u 1, calculating the K B key, and calculating u 2 on 
subject B, the parameters beta, src, K B — HASH(src), beta”P, and u 2 
take the following values: 


beta=0x448781782BF7C0E52A1DD9E6758FD3482D90D3CFCCF42232CF357E59A4D49FD4 
sre: 

16 Al 2D 88 54 TE 1C 90 06 BA AO 08 E8 CB EC C9 

D1 68 91 ED C8 36 CF B7 5F SE B9 56 FA 76 11 94 

D2 8E 25 DA D3 81 8D 16 3C 49 4B 05 9A 8C TÜ A5 

Al B8 8A 7F 80 A2 EE 35 49 30 18 46 54 2C 47 OB 
K B: 

BE TE TE 47 B4 11 16 F2 C7 JE 3B 8F CE 40 30 72 

CA 82 45 OD 65 DE FC 71 A9 56 49 H4 DE EA EC EE 
beta”b: 
= Üx4B9CÜAB55A938121F282F48A2CC4396EB16E7E0068B495BOC1DD4667786A3EB7 
0x223460AA8E09383E9DF9844C5A0F2766484738E5B30128A171B69A77D9509B96 


x 


Ke 
2 
X = 0x2ED9B903254003A672E89EBEBC9E31503726AD124BBSFCOA726EEOE6FCCE323E 
Y = Üx4CF5E1042190120391EC8DB62FE25E9E26EC60FBOB78B242199839C295FCD022 


When processing u 2 and calculating the key on subject A, the K A key 
takes the folloving values: 


K A: 
BE JE TE 47 B4 11 16 F2 C7 TE 3B 8F CE 40 30 72 
CA 82 45 OD 65 DE FC 71 A9 56 49 E4 DE EA EC EE 


The message MAC A — HMAC(K A, 0x01 | | ID_A | | ind | | salt | | ın | | u_2) 
from subject A takes the following values: 


MAC_A: 
D3 B4 1A E2 C9 43 11 36 06 3E 6D 08 A6 1B EY 63 
BD 5E D6 Al FF F9 37 FA 8B 09 OA 98 El 62 BF ED 


The message MAC_B = HMAC(K_B, 0x02 | | ID_B | | ind | | salt | | nl | | u_2) 
from subject B takes the following values: 


MAC_B: 
D6 B3 9A 44 99 BE D3 EO 4F AC F9 55 50 2D 16 B2 
CB 67 4A 20 5F AC 3C D8 3D 54 EC 2F D5 FC E2 58 
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A.2.4. Curve id-tc26-gost-3410-2012-512-paramSetA 


The input protocol parameters in this example take the following 
values: 


00 00 00 00 
00 00 00 00 
31 32 33 34 35 36 ("123456") 


29 23 BE 84 El 6C D6 AH 52 90 49 F1 F1 BB E9 EB 


T 


X = Üx2A17F8833A32795327478871B5C5ESSAEFB91126C64B4B8327289BEA62559425 
D18198F133F400874328B220C74497CD240586CB249E158532CB8090776CD61C 
Y = 0x728F0C4A73B48DA41CE928358FAD2 6B4 7A6E0 94E93 62BAE82559F 83CDDC4EC3A 
4676BD3707EDEAFACD85E99695C64C241EDC622BE87DCOCF87F51F4367F723C5 


The function F(PW, salt, 2000) takes the following values: 


F(PW, salt, 2000): 

BD 04 67 3F 71 49 BI SE 98 15 5B DI E2 72 4E 71 
DÜ 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67 
1C 62 13 E3 93 OE FD DA 26 45 17 92 C6 20 81 22 
EE 60 D2 00 52 OD 69 5D FD 9F 5F OF D5 AB A7 02 


The coordinates of the point Q PW are: 


X = Ox0COAB53DOE0A9C607CAD758F558915A0A7DC5DC87B45E9A58FDDF30EC3385960 
283E030CD322D9E46B070637785FD49D2CD711F46807A24C40AF9A42C8E2D740 
Y = OxDF93A8012B86D3A3DA4F8A4D487DA15FC739EB31B20B3B0E8C8C032AAF8072C63 


37CF7D5B404719E5B4407C41D9A3216A08CA69C271484E9ED72B8AAA52E28B8B 
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During the calculation of u 1 on subject A, the parameter alpha, 
the point alpha”P, and u 1 take the following values: 


alpha-0x3CE54325DB52FE 798824AEAD11BB16FA 76685 7DO4A4AF 7D468672F 16D 90E 7396 
046A46F815693E85B1CE5464DA9270181F82333B0715057BBE8D61D400505F0E 
alpha*P: 
X = 0xB93093EB0FCC463239B7DF276E09E592FCFC9B635504EA4531655D76A0A3078E 
2B4E51CFE2FA400CC5DE9FBE369DB204B3E8ED7/EDD85EE5SCCA654C1AED70E396 
0x809770B8D910EA30BD2FA89736E91DC31815D2D9B31128077EEDC371E9F69466 
F497DC64DD5B1FADC587F860EE256109138C4A9CD96B628E65A8F590520FC882 


Y 


u 1: 
X = OxE7510A9EDD37B869566C81052E2515E1563FDFE79F1D782D6200F33C3CC2764D 
40D0070B73AD5A47BAE9A8F2289C1B07DAC26A1A2FF9D3ECB0A8A94A4F179F13 
Y = 0xBA333B912570777B626A5337BC7F727952460EEBA2775707FE4537372E902DF5 
636080B25399751BF48FB154F3C2319A91857C23F39F89EF54A8F043853F82DE 


When processing u 1, calculating the K B key, and calculating u 2 on 
subject B, the parameters beta, src, K B - HASH(src), beta*P, and u 2 
take the following values: 


beta=0xB5C28 6A7 9AA8E97ECOE1 9BC1959A1D15F12F8C97870BA9D68CC12811A56A3BB1 
1440610825796A49D468CDC9C2D02D76598A27973D5960C5F50BCE28D8D345F4 


src: 
84 59 C2 0C B5 C5 32 41 6D B9 28 EB 50 CO 52 OF 


B2 1B 9C D3 9A 4E 76 06 B2 21 BE 15 CA 1D 02 DA 
08 15 DE C4 49 79 CO 8C 7D 23 07 AF 24 7D DA 1F 
89 EC 81 20 69 F5 D9 CD E3 06 AF FO BC 3F D2 6E 
D2 01 BY 53 52 A2 56 06 B6 43 E8 88 30 2E FC 8D 
3E 95 1E 3E B4 68 4A DB 5C 05 7B 8F 8C 89 B6 CC 
OD EE D1 00 06 5B 51 8A 1C 71 7F 76 82 FF 61 2B 
BC 79 8E C7 B2 49 ÜF B7 00 3F 94 33 87 37 1C 1D 
K B: 
53 24 DE F8 48 B6 63 CC 26 42 2F 5E 45 EE C3 AC 


51 D2 43 61 B1 65 60 CA 58 A3 D3 28 45 86 CB 7A 
beta”b: 
X = 0x238B38644£440452A99FA6B93D9FD7DAOCB83C32D3C1E3CFE5SDF5C3EBOF9DB91 
E588DAEDC849EA2FB867AE855A21B4077353C0794716A6480995113D8C20C7AF 
Y — 0xB2273D5734C1897F8D15A7008B862938C8C74CA7E877423D95243EB7EBDO2FD2 
C456CF9FC956F078A59AAS6F19DD1075E5167E4ED35208718EA93161C530ED14 


X = 0xC33844126216E81B372001E77C1FE9C7547F9223CF7BB865C4472EC18BE0C79A 
678CC5AE4028E3F3620CCE355514F1E589F8A0C433CEAFCBD2EE87884D953411 
0x8B520D083AAF257E8A54EC90CBADBAF4FEED2C2D868C82FF04FCBB9EF6F38E56 
F6BAF9472D477414DA7E36F538ED223D2E2EE02FAE1A20A98C5A9FCF03B6F30D 


K 
Il 
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When processing u 2 and calculating the key on subject A, the K A key 


takes the following values: 


K A: 
53 24 DE F8 48 B6 63 CC 26 42 2F 
51 D2 43 61 BI 65 60 CA 58 A3 D3 


The message MAC A HMAC (K A, 0x01 
from subject A takes the following 


MAC A: 
E8 EF 9E AQ F1 E6 Bl 26 68 E5 8C 
4A 16 71 00 39 FA A6 B6 03 99 22 


The message MAC B HMAC(K B, 0x02 
from subject B takes the following 


MAC B: 
61 14 34 60 83 6B 23 5C EC DO B4 
51 3C 3A 38 78 3F 1C 9D 3B 05 97 


A.2.5. 


5E 45 EE C3 4C 
28 45 86 CB 7A 


|| IDa || ina 
values: 

D2 2D D8 EE C6 
20 FA FE 56 14 
|| IDB || ina 


values: 


9B 58 7E A4 5D 
0A 95 6A 55 BA 


Curve id-tc26-gost-3410-2012-512-paramSetB 


[| salt [| u 1 


[| salt [| u 1 


The input protocol parameters in this example take the following 


values: 


00 00 
00 00 
33 34 35 36 ("123456") 


BE 84 El 6C D6 AH 52 90 49 


F1 F1 BB E9 EB 


E49079285AAF 12] 
1558FF2F4EF7A85725D209 


İl u2) 


|| u2) 


Ox7E1FAE8285E035BEC244BEF2D0E5EBF 4 36633CF50E55231DEA9C9CF21D4C8C33 
DF85D4305DE92971F0A4B4C07E00D87BDBC720EB66 
0x2CC89998B875D4463805BA0D858A196592DB20AB16 


E0171149 


53967AE621AFDEAE89BB7 7C83A2528EF6FCEO2F68BDA4679D7F2704947DBC408 
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The function F(PW, 


F(PW, salt, 


2000): 


BD 04 67 3F 71 49 B1 
DO 09 9A A2 51 74 F7 
IC 62 13 E3 93 OE FD 
EE 60 D2 00 52 OD 69 


The coordinates of the point 


X 


salt, 2000) 


SE 98 15 
92 D3 32 
DA 26 45 
5D FD 9F 


SESPAKE 


5B 
6C 
17 
SE 


D1 
6F 
92 
OF 


Q PW are: 


takes the 


E2 
18 
C6 
D5 


March 2017 


folloving values: 


72 4E 71 
12 70 67 
20 81 22 
AB A7 02 


0x7D03E65B8050D1E12CBB601A17B9273B0E728F5021CD47C8A4DD822E4627BA5F 


9C696286AZCDDA9A065509866B4DEDEDC4A118409604AD549F87A60AFA621161 


Y 


0x16037DAD45421EC50B00D50BDC6AC3B85348BC1D3A2F85DB27C3373580FEF87C 


2C743B7ED30F22BE22958044E716F93A61CA3213A361A2797A16A3AE62957377 


During the calculation of u 1 on subject A, the parameter alpha, 


the point alphašP, 


and u 1 take the following values: 


alpha-0x715E893FA639BF341296E0623E6D29DADF26B163C278767A7982A989462A3863 
FE12AEF8BD403D59C4DC4720570D4163DB0805C7C10C4E818F 9CB785B04B9997 


X = Üx10C479EA1C04D3C2C02B0576A9C42D96226FF033C1191436777F66916030D87D 


alpha*P: 
02FB93738ED7 
Y = 0x039F60441914041 
52FBD943BF04 
ul: 
DE 
FF163FE720448B41 
Y — 


0x45C05CCE8290762F2470B719B4306D62] 
E7332AD8CB 


669D07619FFCE7C1F3C4DB5E5DF4 9E218 6D6FA1LE2EB5767602B9 
E707F26D59D979136A831CCE43E1C5F0600D1DDF8F39DOCA3D 
DDCED1AA2CE8F5EBD7 48 7ACDEF239C07D015084D796784F35436 


B2911CEB144F7F72EF11D10498C7E921 


EC3C12117820F53A60762315BCEB5BCEDA5CF1E0 
Üx5BE483E382DOF5F0748C4F6A5045D99E62755B5ACC9554EC4A5B2093E121A2DD 


5C6066BC9EDE39373BA19899208BB419E£E38B39BBDEDEBOBO9A5CAAEAA984D02E 
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When processing u 1, 


subject B, 


take the following values: 


SESPAKE 


calculating the K B key, 


the parameters beta, 


src, 


K_B 


HASH(src), 


March 2017 


and calculating u_2 on 
beta*P, 


and u_2 


beta-0x30FA8C2B4146C2DBBE82BED04D7378877E8C06753BDOAOFF71EBF2BEFE8DA8F3 


Src: 
3F 
9B 
DO 
8A 
B4 
19 
E2 
FE 

K B: 
D5 
A5 


04 
BA 
A2 
63 
18 
64 
9D 
BO 


90 
GG 


beta*P: 
0x34C0149E7BB91AE377B02573FCCA48AF7BFB7B16DEB8F9CE870F384688E3241A3 


X 


02 
F4 
87 
B3 
D8 
6A 
6B 
ED 


EO 


E4 
80 
98 
IB 
01 
IB 
69 
83 


5E 


OA 
F8 
4F 
EB 
E4 
AF 
AC 
8E 


F5 


9D 
EA 
59 
2D 
90 
44 
CE 
D9 


AE 


59 
FB 
DI 
F5 
AE 
D2 
ED 
1E 


CE 


66 


AS68588CCOEF4364CCA67D17E3260CD824 


6F 


85 


CD 


Bl 


63 
D1 
02 
9F 
13 
36 
4E 
92 


8B 
TE 


20 
25 
04 
8A 
3F 
FC 
62 
12 


7C 
7C 


5B 
5A 
B5 
F7 
04 
ez 
AB 
AB 


FB 
C7 


CD 
EC 
F4 
3C 
F4 
1B 
B2 
A3 


FC 
16 


F4 
E6 
SE 
20 
F3 
TE 
OD 
89 


71 
C5 


G 


U OU U 


ABB o S 


n 


89 
57 
77 
CA 
D8 
sr 
78 
4E 


45 
Fl 


77 
26 
F3 
8B 
FE 
C6 
AC 
56 


SF 
70 


91 
4B 
CE 
50 
8E 
Al 
F4 
DC 


ER 
E9 


DC0836468E2CE7C5C961281B6505140F8407413F03C2CB1D201EA1286CE30E6D 


85C202ADC76F895D5DF673B1788E67 


0x608E944929BD643569ED5189DB871453F13333A1EAF82B2FE1BE8100E775F13D 


0x0535F95463444C4594B5A2E14B35760491C670925060B4BE 
S1F89026E04282B040925D9250201024ACA4 
0x40E6C2E55A 


D9925BD317B63BFAF05024D4A7388523321 


B64501195C1B2EF789E34F23DDAFC5 


BC97DE3A3076D1A5 


B2713569B6C391 6A6F3344B840AD 
EC31E7BCB6EA0242857FC6DFB5409803EDF4CA20141F72CC3C7988 


706E076765F4F004340E5294A7F8E53BA59CB67502F0044558C854A7D63FE900 


When processing u 2 and calculating the key on subject A, the K A key 
takes the following values: 


K A: 


D5 90 EO 5E F5 AE 
A5 CC 66 6F 85 CD 


CE 8B 7C FB FC 


The message MAC A = 


MAC A: 
DE 46 BB 4C 8C EO 8A 6E F3 B8 DF 
8D 8C 27 B6 CB OF CF 59 23 86 A6 


Smyshlyaev, 


et al. 


HMAC (K A, 
from subject A takes the following 


BL. 7E JG: C156 


0x01 


71 BE 45 5F 29 
C5 9F F1 70 E9 


|| IDa || ina || sait || u1 || u2) 
values: 


AC CC 1A 39 BO 
48 F4 E5 BD 8C 
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The message MAC B — HMAC(K B, 0x02 | | ID_B | | ind | | salt | | u_l | | u_2) 
from subject B takes the following values: 


MAC_B: 
EC B1 1D E2 06 1C 55 F1 D1 14 59 CB 51 CE 31 40 
99 99 99 2F CA A1 22 2F B1 4F CE AB 96 EE 7A AC 


A.2.6. Curve id-tc26-gost-3410-2012-256-paramSetA 


The input protocol parameters in this example take the following 
values: 


00 00 00 00 
00 00 00 00 
31 32 33 34 35 36 ('123456") 


29 23 BE 84 El 6C D6 AH 52 90 49 F1 F1 BB E9 EB 


X = ÜxB51ADF93A40AB15792164FAD3352F95B66369EB2A4EF5EFAE32829320363350E 
Y = 0x74A358CC08593612F5955D249C96AFB7E8BOBB6D8BD2BBE491046650D822BE18 


The function F(PW, salt, 2000) takes the following values: 
F(PW, salt, 2000): 

BD 04 67 3F 71 49 B1 8E 98 15 5B DI E2 72 4E 71 

DO 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67 


The coordinates of the point Q PW are: 


OxDBF99827078956812FA48C6E695DF589DEF1D18A2D4D35A96D75BF6854237629 
Üx9FDDD48BFBC57BEEİDAOCFF282884F284D471B388893C48F5ECBOZFC18D67589 


X 
Y 


During the calculation of u 1 on subject A, the parameter alpha, 
the point alpha*P, and u 1 take the following values: 


alpha=0x147B72F6684FB8FD1B418A899F7DBECAF5FCE60B13685BAA95328654A7F0707F 
alpha*P: 
X = 0x33FBAC14EAE538275A769417829C431BD9FA622B6F02427EF55BD60EE6BC2888 
Y = Üx22F2EBCF960A82E6CDB4042D3DDDA511B2FBA925383C2273D952EA2D406EAE46 
m 
X = 0xE569AB544E3A13C41077DE97D659A1B7A13F61DDD808B633A5621FE2583A2C43 
Y = 0xA21A743A08F4D715661297ECD6F86553A808925BF34802BF7EC34C548A40B2C0 
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When processing u 1, calculating the K B key, and calculating u 2 on 
subject B, the parameters beta, src, K B — HASH(src), beta”P, and u 2 
take the following values: 


beta=0x30D5CFADAA0E31B405E6734C03EC4C5DF0F02F4BA25C9A3B320EE6453567B4CB 
src: 

A3 39 AO B8 9C EF 1A 6F FD 4C Al 28 04 9E 06 84 

DF 4A 97 75 B6 89 A3 37 84 1B F7 D7 91 20 7F 35 

11 86 28 F7 28 8E AA OF TE C8 1D A2 OA 24 FF 1E 

69 93 C6 3D 9D D2 6A 90 B7 4D DI A2 66 28 06 63 


7D F7 1A C3 27 ED 51 7D OD E4 03 E8 17 C6 20 4B 
C1 91 65 B9 D1 00 2B 9F 10 88 A6 CD A6 EA CF 27 


o 
© 
M ct 
9 
We 


= 0x2B2D89FAB735433970564F2F28CFA1B57D640CB902BC6334A538F44155022CB2 
Ox10EF6A82EEF1E70F942AA81D6B4CE5DECODDB9447512962874870E6F2849A96F 


Ke 
2 
X = 0x190D2F283F7E861065DB53227D7FBDF429CEBF93791262CB29569BDF63C86CA4 
Y = 0xB3F1715721E9221897CCDE046C9B843A8386DBF7818A112F15A02BC820AC8F 6D 


When processing u 2 and calculating the key on subject A, the K A key 
takes the following values: 


K A: 
7D F7 1A C3 27 ED 51 7D OD E4 03 E8 17 C6 20 4B 
C1 91 65 B9 DI 00 2B 9F 10 88 A6 CD A6 EA CF 27 


The message MAC A — HMAC(K A, 0x01 | | ID_A | | ind | | salt | | ın | | u_2) 
from subject A takes the following values: 


MAC_A: 
F9 29 B6 1A 3C 83 39 85 B8 29 F2 68 55 7F AB 11 
00 9F 82 OA BI A7 30 B5 AA 33 4C 3E 6B A3 17 TF 


The message MAC_B = HMAC(K_B, 0x02 | | ID_B | | ind | | salt | | nl | | u_2) 
from subject B takes the following values: 


MAC_B: 
A2 92 8A 5C F6 20 BB C4 90 OD H4 03 F7 FC 59 A5 
E9 80 B6 8B EO 46 DO B5 D9 B4 AE 6A BF A8 OB D6 
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A.2.7. Curve id-tc26-gost-3410-2012-512-paramSetC 


The input protocol parameters in this example take the following 
values: 


00 00 00 00 
00 00 00 00 
31 32 33 34 35 36 ("123456") 


29 23 BE 84 El 6C D6 AE 52 90 49 F1 F1 BB E9 EB 


T 


X = 0x489C91784E02E98F19A803ABCA319917F37689E5A18965251CE2FF4E8D8B298F 
5BA7470F9EOE713487F96F4A8397B3D09A270C9D367EB5E0E6561ADEEB51581D 
Y = Üx684EASS5ACA64EAF1B3FEE36C0852A3BE3BD8011BOEF18E203FF87028D6EB5DB 
2C144A0DCC71276542BFD72CA2A43FA4F4939DA66D9A60793C704A8C94E16F18 


The function F(PW, salt, 2000) takes the following values: 


F(PW, salt, 2000): 

BD 04 67 3F 71 49 BI SE 98 15 5B DI E2 72 4E 71 
DÜ 09 9A A2 51 74 F7 92 D3 32 6C 6F 18 12 70 67 
1C 62 13 E3 93 OE FD DA 26 45 17 92 C6 20 81 22 
EE 60 D2 00 52 OD 69 5D FD 9F 5F OF D5 AB A7 02 


The coordinates of the point Q PW are: 


X = 0x0185AE6271A81BB7F236A955F7CAA26FB63849813C0287D96C83A15AE6B6A864 
67AB13B6D88CE8CD7DC2E5B97FF5F28FAC2C108F2AS3CF3DB5515C9E6D7D210E8 
Y = 0xED0220F92EF771A71C64ECC77986DB7C03D37B3E2AB3E83F32CE5E074A762EC0 
8253C9E2102B87532661275C4B1D16D2789CDABC58ACFDF7318DE70AB64F09B8 


During the calculation of u 1 on subject A, the parameter alpha, 
the point alpha*P, and u 1 take the following values: 


alpha=0x332F930421D14CFE260042159F18E4 9FD5A54167E94108AD80B1DE60B13DE799 
9A34D611E63F3F870E5110247DF8EC7466E648ACF385E52CCB889ABFA491EDFFO 


alpha*P: 
X = 0x561655966D52952E805574F4281F1ED3AZD498932B00CBA9DECB42837F09835B 
FFBFE2D84D6B6B242FE7B57F92E1A6F2413E12DDD6383E4437E13D72693469AD 

Y = 0xF6B18328B2715BD7F4178615273A36135BCOBF62F7D8BB9F080164AD36470AD0 
3660F51806C64C6691BADEF30F793720FSE3FEAED631D6A54A4C372DCBF80E82 
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u 1: 
X = 0x40645B4B9A908D74DEF 98886A336F98BAE6ADA4C1AC9B7594A33D5E4A16486C5 
533C7F3C5DD84797AB5B4340BFC70CAF1011B69A01A715E5B9B5432D5151CBD7 
Y = 0x267FBB18D0B79559D1875909F2A15F7B49ECD8ED166CF7F4FCD1F44891550483 


5E80D52BE8D34ADA5B5E159CF52979B1BCFE8F5048DC443A0983AA19192B8407 


When processing u 1, calculating the K B key, and calculating u 2 on 
subject B, the parameters beta, src, K B - HASH(src), beta*P, and u 2 
take the following values: 


beta-0x38481771E7D054F96212686B613881880BD8A6C89DDBC656178F014D2C093432 
A033EE10415F13A160D44C2AD61E6E2E05A7F7EC28 6BCEA3EA4D4D53F 8 634FA2 


src: 

AF 4D 64 B5 DO 70 08 E9 E6 85 87 4F 88 2C 3E 1E 

60 A6 67 5E ED 42 1F C2 34 16 3F DE B4 4C 69 18 
B7 BC CE AB 88 AO F3 FB 78 SD A8 DB 10 18 51 FF 
1A 41 68 22 BA 37 C3 53 CE C4 C5 A5 23 95 B7 72 
AC 93 CO 54 E3 F4 05 5C ED 6F FO BE E4 A6 A2 4E 
D6 8B 86 FE FA 70 DE 4A 2B 16 08 51 42 A4 DF FO 
5D 32 EC 7D DF E3 04 F5 C7 04 FD FA 06 OF 64 E9 
ES 32 14 00 25 F3 92 E5 03 50 77 OE 3F B6 2C AC 
K B: 

AO 83 84 A6 2F 4B El AE 48 98 FC A3 6D AA 3F AA 

45 1B 3E C5 B5 9C E3 75 F8 9E 92 9F 4B 13 25 8C 
beta*P: 

X = 0xB7C5818687083433BC1lAFF61CB5CA79E38232025E0C1F123B8651E62173CE687 


3F3EGFFE7281C2E45F4F524F66B0C263616EDOSFD210AC4355CA3292B51D71C3 
Y = 0x497F14205DBDC89BDDAF50520ED3B1429AD30777310186BE5E68070F016A44E0 
C766DBOSESAC23FBDFDE6D675AA4DF591EB18BAOD348DF7AA40973A2FIDCFA55 

u 2: 
X = ÜxB772FD97DöFDEC1DA0771BCO59B3E5ADF9858311031EAE5AEC6A6EC8104B4105 


C45A6C65689A8EE636C687DB62CCOAFC9A48CA66E381286CC73F374C1DD8F445 
Y = 0xC64F69425FFEB2995130E85A08bEDC3A686EC28EE6E8469F7F09BD3BCBDD843AC 
573578DA6BA1CB3F5F069F205233853F06255C4B28586C9A1643537497B1018C 


When processing u 2 and calculating the key on subject A, the K A key 
takes the following values: 


K A: 
AO 83 84 A6 2F 4B El AE 48 98 FC A3 6D AA 3F AA 
45 1B 3E C5 B5 9C E3 75 F8 9E 92 9F 4B 13 25 8C 


The message MAC A — HMAC(K A, 0x01 | | ID_A | | ind | | salt | | u 1 | | u_2) 
from subject A takes the following values: 


MAC_A: 
12 63 F2 89 OE 90 EE 42 6B 9B AO 8A B9 EA ”F 1F 
FF 26 El 60 5C C6 5D H2 96 96 91 15 E5 31 76 87 
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The message MAC B — HMAC(K B, 0x02 | | ID_B | | ind | | salt | | u_l | | u_2) 
from subject B takes the following values: 


MAC_B: 
6D FD 06 04 5D 6D 97 AO E4 19 BO OE 00 35 B9 D2 
E3 AB 09 8B 7C A4 AD 52 54 60 FA B6 21 85 AA 57 


Appendix B. Point Verification Script 


The points from Appendix A.1 were generated with the following point 
verification script in Python: 


curvesParams = [ 

{ 

"OID": "id-GostR3410-2001-CryptoPro-A-ParamSet", 
"p":0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97, 
"a":0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD94, 
"572166 
"m":0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893, 
q":0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF6C611070995AD10045841B09B761B893, 
kj 
y":0x8D91E471E0989CDA27DF505A453F2B7635294F2DDF23E3B122ACC99C9E9F1E14, 
n":32 


"OID":"id-GostR3410-2001-CryptoPro-B-ParamSet", 

"p":0x8000000000000000000000000000000000000000000000000000000000000C99, 

"a":0x8000000000000000000000000000000000000000000000000000000000000C96, 

"b":0x3ElAF419A269A5F866A7D3C25C3DF80AE979259373FF2B182F49D4CETEİBBC8B, 

"m":0x800000000000000000000000000000015F700CFFF1A624E5E497161BCC8A198F, 
q":0x800000000000000000000000000000015F700CFFF1A624E5E497161BCC8A198F, 

"x":1, 
y":0x3FA8124359F96680B83D1C3EB2C070E5C545C9858D03ECFB744BF8D717717EFC, 
n":32 


"OID":"id-GostR3410-2001-CryptoPro-C-ParamSet", 

"p":0x9B9F605F5A858107AB1EC85E6B41C8AACF846E86789051D37998F7B9022D759B, 
"a":0x9B9F605F5A858107AB1EC85E6BA41C8AACF846E86789051D37998F7B9022D7598, 
"p":32858, 
"m" : Ox9B9F605F5A858107ABIEC85E6B41C8AA582CA3511EDDFB74F02F3A6598980BB9, 
g" :0x9B9F605F5A858107AB1EC85E6B41C8AA582CA3511EDDFB74F02F3A6598980BB9, 
"x". 
y 
n 


":0x41ECE55743711ASC3CBF3783CDOÜSCOEE4D4DC440D4641A8F366E550DFDB3BB67, 
.əz 
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{ 

"OID":"id-tc26-gost-3410-2012-512-paramSetA", 

"p": (OxFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««296)-*N 
(OxFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««80)-*N 
OxFFFFFFFFFFFFFFFFFDCTL, 

"a":(O0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««296)-4N 
(OxFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««80)-N 
OxFFFFFFFFFFFFFFFFFDCAÁL, 

"p": (OXE8C2505DEDFC8 6DDC1BD0B2B6667F1DA34B82574761CB0E87 9BDO8L<<296) +\ 
(Ox1CFD0B6265EE3CBO090F30D27614CB4574010DA90DD8 62EF 9D4EBEEL<<80) +\ 
0x4761503190785A71C760L, 

"m": (OxFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL<<296)+X 
(OxFFFFFFFFFF27E69532F48D89116FF22B8D4E0560609B4B38ABFAD2L<<80)+X 
OxB85DCACDB1411F10B275L, 

"q":(O0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««296)-*N 
(OxFFFFFFFFFF27E69532FA48D89116FF22B8D4E0560609B4B38ABFAD2L««80) HA 
OxB85DCACDB1411F10B275L, 

"x":3, 

"y": (0x7503CFE87A836AE3A61B8816E25450E6CE5E1C93ACF1ABC1778064L<<296) +\ 
(OxFDCBEFA921DF1626BE4FD036E93D75E6A50E3A41E98028FE5FC235L««80) HA 
ÜxF5B889A589CB5215F2A4L, 

"n":64 

DÉI 

{ 

"OID":"id-tc26-gost-3410-2012-512-paramSetB", 

"po": (0x8000000000000000000000000000000000000000000000000000001<<296) +\ 
(0x000000000000000000000000000000000000000000000000000000L<<80) +\ 
Ox0000000000000000006FL, 

"a": (0x8000000000000000000000000000000000000000000000000000001<<296) +\ 
(0x000000000000000000000000000000000000000000000000000000L<<80) +\ 
Ox0000000000000000006CL, 

"b": (0x687D1B459DC841457E3E06CF 6F5E2517B97C7D614AF138BCBF 8 5DCL<<296) HA 
(0x806C4B28 9F3E965D2DB1416D217F8B27 6FAD1AB69C50F78BEE1FA3L<<80) HA 
Üx106EFBSCCBC7C5140116L, 

"m": (0x8000000000000000000000000000000000000000000000000000001<<296) +\ 
(0x000000000149A1EC142565A545ACFDB77BD9D40CFA8B996712101BL<<80) +N 
OxEA0EC6346C54374F25BDL, 

"g": (0x8000000000000000000000000000000000000000000000000000001<<296) +\ 
(0x000000000149A1EC142565A545ACFDB77BD9D40CFA8B996712101BL<<80) +) 
OxEA0EC6346C54374F25BDL, 

"x" :2, 

"y": (OXLA8F7EDA38 9B0 94C2C071E3647A8 940F3C123B697578C213BE6DD9L<<296) +\ 
(0xE6C8EC7335DCB228FD1EDF4A39152CBCAAF8C0398828041055F94CL««80) +\ 
OxEEEC7E21340780FE41BDL, 

"Tn" + 64 
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( 


"OID":"id-tc26-gost-3410-2012-256-paramSetA", 


:0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD97, 
:0xC2173F1513981673AF 4892C23035A2 7CE25E 201 3BF 95AA 33B22C656F 27757335, 
:0x295F9BAE7428bED9CCC20E7C359A9D41A22FCCD9108E17BF7BA9337A6F8AE9513, 
:0x1000000000000000000000000000000003F63377F21ED98D70456BD55B0D8319C, 
:0x400000000000000000000000000000000FD8CDDFC87B6635C115AF556C360C67, 
:0x91E38443A5E82C0D880923425712B2BB658B9196932E02C78B2582FE742DAA28, 
:0x32879423AB1A0375895786C4BB46E9565FDE0B5344766740AF268ADB32322E5C, 
$32 


"OID":"id-tc26-gost-3410-2012-512-paramSetC", 


"p" H 


nan. 
a : 


"pb" H 


(OxFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««296)-*N 
(OxFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««80)-*N 
OxFFFFFFFFFFFFFFFFFDCTL, 
(0xDC9203E514A721875485A529D2C722FB187BC8980EB866644DEA41CL««296) +\ 
(0x68E143064546E861COE2C9EDD92ADE71FA46FCF50FF2AD97F951FDAL««80)-*N 
Üx9F2A2EB6546F39689BD3L, 
(OxB4C4EE2 8CEBC 6C2C8AC12952CF37F1 6AC7EFB6A9F 6 9F4B5 7FFDA2ZEL<<2 96) +\ 
(Ox4F ODESADE038CBC2FFF719D2C18DE02 84B8BFEF 3B52B8CC7A5F5BFL<<80) HA 
0x0A3C8D2319A5312557E1L, 


: (OXFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL<<296)+N 


(OxFFFFFFFFFF26336E91941AACO130CEA7FD451D40B323B6A79E9DA6L««80) HA 
0x849A5188F3BD1FCO8FB4L, 


:(Ox3FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFL««296)-*N 


(OxFFFFFFFFFFC98CDBA46506AB004C33A9FF5147502CC8EDA9E7A7769L««80) HA 
0xA12694623CEF47F023EDL, 


: (OXE2E31EDFC23DE7BDEBE2 41CE5 93EF5DE2 2 95B7A9CBAEF021D385F7L<<296) +\ 


(0x074CEA043AA27272A7AE602BF2A7B9033DB9ED3610C6FB8548 7EAEL<<80) +\ 
0x97AAC5BC7928C1950148L, 


: (OXF 5CE40D95B5EB8 9 9ABBCCFF5911CB8577939804D6527378B8C108CL<<296) +\ 


(0x3D2090FF9BE18E2D33E3021ED2EF32D85822423B6304F726AA854BL<<80)+X 
OxAE07D0396E9A9ADDC40FL, 


:64 
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def str2list( s ): 
res = [] 
for c in s: 
res += [ ord( c ) ] 
return res 


def list2str( 1 ): 
r — we 
for k in 1: 
r += chr( k) 
return r 


def hprint( data ): 
r= 
for i in range( len( 
r += "$02X " 
if i % 16 
r += "n" 
print( r) 


class Stribog: 


— = | 
0x8e20faa72ba0b470, 
Oxd8045870ef14980e, 
Ox1b8e0b0e798c13c8, 
0x5086e740ce47c920, 
0x0ad97808d06cb404, 
0x46b60f011a83988e, 
0x24b86a840e90f0d2, 
0x8al74a9ec8121e5d, 
Ox9d4df05d5f661451, 
0x302a1e286fcb58ca7, 
0x0642ca05693b9f70, 
0x439da0784e745554, 
Oxe230140fc0802984, 
0x5b068c651810a89e, 
0x561b0d22900e4669, 
0xc3e9224312c8c1a0, 
Oxe4fa2054a80b329c, 
0x9258048415eb419d, 
0x550b8e9e21f7a530, 
0x3853dc371220a247, 
0x07e095624504536c, 
0x641c314b2b8ee083 


Smyshlyaev, et al. 


SESPAKE 


data ) ): 
$ data[ il 


0x47107ddd9b505a38, 
0x6c022c38£90a4c07, 
0x83478b07b2468764, 
0x2843fd2067adea10, 
0x05e23c0468365a02, 
0x90dab52a387ae76f, 
0x125c354207487869, 
0x4585254f64090fa0, 
Oxc0a878a0a1330aa6, 
0x18150f14b9ec46dd, 
0x0321658cba93c138, 
Oxafc0503c273aa42a, 
0x71180a8960409a42, 
0x456c34887a3805b9, 
0x2b838811480723ba, 
Oxeffallaf0964ee50, 
0x727d102a548b194e, 
0x492c024284fbaec0, 
Oxa48b474f9ef5dc18, 
Ox1ca76e95091051ad, 
0x8d70c431ac02a736, 
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0xad08b0e0c3282d1c, 
0x3601161cf205268d, 
0xa011d380818e8f40, 
0x14aff010bdd87508, 
Ox8c711e02341b2d301, 
0x486dd4151c3dfdb9, 
0x092e94218d243cba, 
Oxaccc9ca9328a8950, 
0x60543c50de970553, 
0x0c84890ad27623e0, 
0x86275d3f09ce8aaa8, 
0xd960281e9d1d5215, 
Oxb60c05ca30204d21, 
Oxac361a443d1c8cd2, 
Ox9bcf4486248d9f5d, 
0xf97d86d98a327728, 
0x39b008152acb8227, 
0xaa16012142f35760, 
0x70a6a56e2440598e, 
Ox0edd37c48a08a6d8, 
0xc83862965601dd1b, 
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OxFC, ÜxEE, OxDD, 0x11, OxCF, Ox6E, 0x31, 0x16, OxFB, 0xC4, ÜXFA, 
OxDA, 0x23, 0xC5, 0x04, 0x4D, ÜxE9, 0x77, ÜxFÜ, OxDB, 0x93, Ox2E, 
0x99, OxBA, 0x17, 0x36, OxF1, OxBB, 0x14, OxCD, Ox5F, 0xC1, OxF9, 
0x18, 0x65, Ox5A, OxE2, Üx5C, ÜxEF, 0x21, 0x81, Ox1C, Ox3C, 0x42, 
0x8B, 0x01, Üx8E, Ox4F, 0x05, 0x84, 0x02, OxAE, OxE3, Ox6A, Ox8F, 
OxA0, 0x06, ÜxÜB, OxED, 0x98, Ox7F, OxD4, OxD3, Üx1F, OxEB, 0x34, 
Ox2C, 0x51, OxEA, 0xC8, 0x48, OxAB, OxF2, Ox2A, 0x68, OxA2, OxFD, 
0x3A, OxCE, OxCC, OxB5, 0x70, OxOE, 0x56, 0x08, 0x0C, 0x76, 0x12, 
OxBF, 0x72, 0x13, 0x47, Ox9C, OxB7, Ox5D, 0x87, 0x15, OxA1, 0x96, 
0x29, 0x10, Ox7B, Üx9A, OxC7, OxF3, 0x91, 0x78, Ox6F, Ox9D, Ox9E, 
OxB2, OxB1, 0x32, 0x75, 0x19, Ox3D, OxFF, 0x35, Ox8A, Ox7E, Ox6D, 
0x54, OxC6, 0x80, OxC3, OxBD, OxOD, 0x57, OxDF, OxF5, 0x24, OxA9, 
Ox3E, OxA8, 0x43, OxC9, OxD7, 0x79, OxD6, OxF6, Ox7C, 0x22, 0xB9, 
0x03, OxEO, ÜxÜF, OxEC, OxDE, Ox7A, 0x94, OxBO, OxBC, OxDC, 0xE8, 
0x28, 0x50, Ox4E, 0x33, Ox0A, Ox4A, OxA7, 0x97, 0x60, 0x73, OxlE, 
0x00, 0x62, 0x44, Ox1A, OxB8, 0x38, 0x82, 0x64, Ox9F, 0x26, 0x41, 
OxAD, 0x45, 0x46, 0x92, 0x27, Üx5E, 0x55, 0x2F, Ox8C, ÜxA3, OxA5, 
Ox7D, 0x69, OxD5, 0x95, Ox3B, 0x07, 0x58, OxB3, 0x40, 0x86, OxAC, 
Ox1D, OxF7, 0x30, 0x37, Ox6B, OxE4, 0x88, OxD9, OxE7, 0x89, OxEl, 
0x1B, 0x83, 0x49, 0x4C, Ox3F, OxF8, OxFE, Ox8D, 0x53, OxAA, 0x90, 
OxCA, OxD8, 0x85, 0x61, 0x20, 0x71, 0x67, OxA4, Ox2D, Ox2B, 0x09, 
Üx5B, OxCB, Üx9B, 0x25, OxDO, OxBE, ÜxE5, 0x6C, 0x52, 0x59, 0xA6, 
0x74, ÜxD2, ÜxE6, ÜxF4, OxB4, OxCO, OxD1, 0x66, OxAF, OxC2, 0x39, 
0x4B, 0x63, ÜxB6 


_ Tau = [ 
0, 8, 16, 24, 32, 40, 48, 56, 
1 95 X7, i25, 33, 41, 49, 5, 
2, 10, 18, 26, 34, 42, 50, 58, 
Std, £97527, 355 43, 51; 59; 
4, 12, 20, 28, 36, 44, 52, 60, 
Dip 135 21, 297. 375-45; 535.01; 
6, 14, 22, 30, 38, 46, 54, 62, 
Tp. oe 23$ 31, 39: 47; 55,063 
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Oxb1, 0x08, Ox5b, Oxda, Oxle, Oxca, Oxda, Üxe9, 
Oxeb, Oxcb, Ox2f, 0x81, ÜxcÜ, 0x65, Ox7c, Ox1f, 
0x2f, Ox6a, 0x76, 0x43, Üx2e, 0x45, 0xd0, 0x16, 
0x71, Ox4e, Oxb8, Ox8d, 0x75, 0x85, Oxc4, Üxfc, 
Ox4b, Ox7c, Üxe0, 0x91, 0x92, 0x67, 0x69, 0x01, 
Oxa2, 0x42, Ox2a, 0x08, Oxa4, 0x60, Oxd3, 0x15, 
0x05, 0x76, 0x74, 0x36, Oxcc, 0x74, 0x4d, 0x23, 
Oxdd, 0x80, 0x65, 0x59, Üxf2, Oxa6, 0x45, 0x07 


Ox6f, Oxa3, Oxb5, 0x8a, 0xa9, 0x9d, 0x2f, Oxla, 
0x4f, Oxe3, Ox9d, 0x46, ÜxÜf, 0x70, Oxb5, Oxd7, 
Oxf3, Oxfe, Üxea, 0x72, 0x0a, 0x23, Ox2b, 0x98, 
0x61, Oxd5, Üx5e, ÜxÜf, Üx16, Oxb5, 0x01, 0x31, 
Ox9a, Oxb5, 0x17, Ox6b, 0x12, Oxd6, 0x99, 0x58, 
Ox5c, Oxb5, 0x61, Oxc2, Oxdb, 0x0a, Oxa7, Oxca, 
0x55, Oxdd, Oxa2, Oxlb, Oxd7, Oxcb, Oxcd, 0x56, 
Oxe6, 0x79, 0x04, 0x70, 0x21, Oxbl, O0x9b, Oxb7 


Oxf5, 0x74, Oxdc, Oxac, 0x2b, Oxce, 0x2f, Oxc7, 
0x0a, 0x39, Oxfc, 0x28, Ox6a, 0x3d, 0x84, 0x35, 
0x06, Üxf1, Ox5e, Üx5f, 0x52, Ox9c, Ox1f, Ox8b, 
Oxf2, Oxea, 0x75, 0x14, Üxbl, 0x29, 0x7b, 0x7b, 
Oxd3, Oxe2, 0x0f, Oxe4, 0x90, 0x35, 0x9e, Üxbl, 
Oxcl, Oxc9, Ox3a, 0x37, 0x60, 0x62, Oxdb, 0x09, 
Oxc2, Oxb6, Oxf4, 0x43, 0x86, 0x7a, Oxdb, 0x31, 
0x99, Oxle, 0x96, Üxf5, 0x0a, Oxba, 0x0a, Oxb2 


Oxef, Oxlf, Oxdf, Oxb3, Oxe8, 0x15, 0x66, Oxd2, 
Oxf9, 0x48, Oxel, Üxa0, Ox5d, 0x71, Oxe4, Oxdd, 
0x48, Ox8e, 0x85, 0x7e, 0x33, Ox5c, 0x3c, 0x7d, 
Ox9d, 0x72, Oxlc, Oxad, 0x68, Ox5e, 0x35, Ox3f, 
Oxa9, Oxd7, Ox2c, 0x82, Oxed, 0x03, Oxd6, 0x75, 
0xd8, Oxb7, 0x13, 0x33, 0x93, 0x52, 0x03, Oxbe, 
0x34, 0x53, Oxea, Oxal, 0x93, Oxe8, 0x37, Oxfl, 
0x22, 0x0c, Oxbe, Oxbc, 0x84, Oxe3, Oxdl, Üx2e 
1, 
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Ox4b, 
0x9a, 
0OXYE, 
0x35, 
Oxbf, 
Oxdf, 
0x7a, 
0x60, 


Oxae, 
Ox6f, 
0x2d, 
0x18, 
Oxcf, 
0x0a, 
Oxbf, 
Oxfa, 


Oxf4, 
0x51, 
0x39, 
0xd3, 
0x09, 
0x06, 
0x35, 
0x88, 


0x9b, 
0x03, 
0x4e, 
0x89, 
Oxf4, 
0x69, 
0x36, 
Oxa4, 
1, 


Smyshlyaev, 


Oxea, 
Ox3f, 
0x15, 
0x9e, 
Oxcd, 
Oxff, 
0x56, 
0x17, 


Ox4f, 
Oxa4, 
0x66, 
0x7f, 
Oxfa, 
Oxf2, 
0x71, 
0x68, 


Oxc7, 
Oxac, 
0x9e, 
0x47, 
0x92, 
0x47, 
0x17, 
0x86, 


Ox1f, 
Oxe7, 
Oxb7, 
Oxb4, 
0x89, 
Oxd1, 
Oxac, 
0x7f, 
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Ox6b, 
0x41, 
Oxic, 
0x35, 
0x17, 
0x00, 
Oxa2, 
0x58, 


Oxae, 
0xc3, 
Oxc4, 
Ox9a, 
Oxa6, 
Qxlf; 
Oxc5, 
0x40, 


0x0e, 
0x86, 
Oxc6, 
0x3e, 
Oxab, 
0x69, 
Ox45, 
0x56, 


Ox5b, 
Oxaa, 
Oxf8, 
0x44, 
0x2b, 
0x8d, 
Oxc2, 
0x0d, 


Oxac, 
0x0c, 
Ox1f, 
0xd7, 
0x47, 
Oxb7, 
0x7e, 
Oxfd, 


Oxae, 
Ox3b, 
Oxf9, 
Oxb4, 
Oxb7, 
0x66, 
0x72, 
0x7a, 


0x16, 
Oxfe, 
Oxc7, 
0x33, 
Oxc5, 
0x83, 
Ox4c, 
0x4d, 


0x42, 
0x02, 
0x71, 
Ox3b, 
Oxcb, 
Ox2b, 
0x35, 
Oxd4, 
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Oxad, 
Ox6c, 
0x16, 
0x80, 
0x25, 
0x23, 
0xa9, 
0x7c, 


Ox1d, 
0x7a, 
0x51, 
0x9a, 
Oxic, 
Oxc2, 
0x36, 
0x46, 


Oxee, 
Oxbf, 
0xe6, 
0x19, 
0x2d, 
0x28, 
Oxa2, 
Ox3a, 


0x4d, 
0x0c, 
0x9c, 
0x4d, 
0x92, 
0xdl, 
0x59, 
Oxbf, 


0x47, 
0xa9, 
0x86, 
0x0f, 
0x3a, 
0x27, 
Oxea, 
Ox6c, 


0x3a, 
0x30, 
0x42, 
0xf0, 
0x9a, 
Oxbe, 
0x90, 
0x64, 


Oxaa, 
0x24, 
Oxbf, 
0x7a, 
0x82, 
0x4a, 
Ox3c, 
0x14, 


0x93, 
0x6e, 
0x36, 
Oxdb, 
0x9b, 
Oxa5, 
0x51, 
0x02, 


0x47, 
0x23, 
0x10, 
Oxff, 
Oxf5, 
Oxla, 
0x63, 
Oxfe, 


Oxd3, 
0x39, 
Oxa4, 
Ox8e, 
Oxb7, 
Oxc6, 
Ox4f, 
Ox7d, 


Oxc5, 
0x09, 
0x87, 
0x93, 
Ox2c, 
0x05, 
Ox4a, 
Oxd4, 


0xc9, 
0x41, 
Oxde, 
Oxc4, 
0x06, 
Oxc4, 
Oxa8, 
Oxe7, 
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0x99, 
0x63, 
0x4a, 
Oxbd, 
Oxa3, 
0x16, 
Oxf5, 
0x57 


0xd9, 
0xc0, 
Ox6c, 
Oxc6, 
Oxb4, 
Oxb6, 
0x35, 
Ox6e 


Oxec, 
0x54, 
Oxc9, 
Oxc9, 
0x37, 
0x04, 
Oxf3, 
0x93 


Oxa7, 
Ox41, 
Oxle, 
Ox9a, 
0x90, 
0x2f, 
0xd9, 
Oxle 
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0x37, 
0x94, 
Ox3a, 
Ox3c, 
0x80, 
0x7b, 
0x0e, 
0x72, 


Oxab, 
0x38, 
0x89, 
Ox1f, 
Ox9f, 
0x7a, 
0x36, 
0x74, 


0x7b, 
0x30, 
0xd8, 
0x20, 
Ox8a, 
Oxef, 
Oxde, 
Ox6b, 


0x37, 
0xd2, 
Oxcd, 
Oxf8, 
Ox5d, 
Oxe7, 
Oxfa, 
Ox48, 


Smyshlyaev, 


Ox8f, 
Ox4c, 
Ox7d, 
Oxd9, 
0x0a, 
0x2b, 
0x38, 
0x61, 


Oxbe, 
0x2a, 
0x41, 
Oxff, 
Oxe7, 
Oxle, 
0x98, 
Oxb4, 


Oxcd, 
0x02, 
Oxfa, 
0x01, 
0x1d, 
Oxba, 
Oxa2, 
Oxca, 


0x8e, 
0x13, 
Oxa4, 
0x20, 
0x80, 
Ox1d, 
Oxf4, 
Oxbc, 


et al. 


Ox5a, 
0x9a, 
Ox3a, 
0x55, 
0x44, 
Ox8a, 
Oxdc, 
0x44, 


Oxde, 
Oxe5, 
Oxe7, 
0xe1, 
0x67, 
Ox6c, 
Oxfa, 
Oxc7, 


0x9e, 
0xc6, 
Ox6b, 
0x80, 
0x71, 
Oxcd, 
0x59, 
Oxa4, 


Oxe7, 
0x80, 
0x3c, 
0x12, 
Oxef, 
Oxa4, 
0x17, 
0x92, 


0x54, 
Oxd8, 
Oxlb, 
Oxb7, 
0x0b, 
0x9a, 
0x92, 
0x51, 


0xa6, 
0x48, 
Oxlc, 
0x8a, 
0x02, 
0x30, 
0xdl, 
Oxfb, 


0xd0, 
Oxcd, 
Oxbb, 
0x21, 
Oxef, 
Ox1d, 
Ox4a, 
Oxcd, 


0x67, 
OxbO0, 
0x32, 
Oxd4, 
0x9d, 
Oxaa, 
Oxd5, 
Ox4a, 


SESPAKE 


0x16, 0x31, 0x22, 
Oxec, 0x16, Ox5f, 
0x25, 0x89, 0x42, 
0xe0, 0x0d, 0x09, 
Oxdb, Oxb2, Oxce, 
Oxa6, 0x07, Ox9c, 
Oxcb, 0xlf, Üx2a, 
0x83, 0x23, Üx5a, 


0x80, 0x05, Ox6f, 
Oxb2, Oxe4, Üxf3, 
Oxff, Ox8a, 0x78, 
Oxlb, 0x33, 0x61, 
Oxaf, 0x69, 0x33, 
0x3b, 0x76, 0x52, 
0x15, Ox3b, Üxbö, 
0x98, 0x45, Ox9c, 


Oxef, Oxc8, 0x89, 
0x63, Ox5a, Oxfe, 
Oxeb, Oxab, 0x07, 
0x14, 0x84, 0x66, 
Oxea, 0x48, Oxb9, 
Ox7d, 0x47, 0x6e, 
OxcO, Üx6f, Oxd8, 
0x81, Üxf3, Ox2d, 


Oxf1, 0x16, 0x31, 
0x04, 0x49, Üxbl, 
Oxbc, Oxdf, Oxld, 
0x30, 0x21, Ox9f, 
0x18, 0x91, Oxcc, 
0x88, Oxel, 0x28, 
Oxd9, Oxb2, Oxlb, 
Oxf1, Oxlb, Oxd7, 
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Ox9b, 
Oxde, 
0x24, 
0x84, 
Oxb1, 
0x54, 
0x60, 
Oxdb 


0x52, 
Oxf3, 
Oxdb, 
0x03, 
Ox4b, 
Oxf4, 
0xc3, 
Oxed 


Oxfb, 
0x94, 
0x61, 
0x79, 
Oxca, 
0x98, 
Ox5d, 
Oxlb 


Oxba, 
0x7a, 
0x77, 
Ox9b, 
0x86, 
0x52, 
0x99, 
0x20 
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def | AddModulo(self, A, B): 
result - [0] * 64 
t-0 
for i in reversed(range(0, 64)): 
t = A[i] + B[i] + (t >> 8) 
result[i] = t & OxFF 
return result 


def | AddXor(self, A, B): 
result - [0] * 64 
for i in range(0, 64): 
result[i] = Ali) ^ B[i] 
return result 


def | S(self, state): 
result - [0] * 64 
for i in range(0, 64): 
result[i] = self.  Sbox[state[i]] 
return result 


def  P(self, state): 
result — [0] ” 64 
for i in range(0, 64): 
result[i] = statelself. Tau[i]] 
return result 


def  mL(self, state): 
result = [0] * 64 
for i in range(0, 8): 
t-0 
for k in range(0, 8): 
for j in range(0, 8): 
if ((stateli * 8 + kl & (1 << (7 - 1))) 1— 0): 
t ^= self. A[k ” 8 + j] 
for k in range(0, 8): 
resultli * 8 + kl = (t & (ÜxFF << (7 - k) * 8)) >> (7 — k) % 8 
return result 


def | KeySchedule(self, K, i): 
K = self. AddXor(K, self. C[i]) 
= self.  S(K) 
= self.  P(K) 
K = self.  L(K) 
return K 


NA 
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# E(K, m) 
def —. 


state — 
Bor i in 


state = 
state = 
state = 


K — 


state = 


E(self, K, m): 
self.  AddXor(K, m) 


range(0, 12): 


SESPAKE 


self. S(state) 


self. P (state) 
self.  L(state) 


self. KeySchedule (K, 
self.  AddXor(state, 


return state 


def  G n(self, N, h, m): 
K — self. AddXor(h, N) 
K = self. S(K) 
K = self. P(K) 
K = self.  L(K) 
t = self. E(K, m) 
t = self.  AddXor(t, bi 
return self. AddXor(t, 
def  Padding(self, last, 
if (len(last) € 64): 
padding = [0] * (64 - 
padding[-1] = 1 


padded message - 


i) 


K) 
m) 
N, h, Sigma): 
len(last)) 


padding + last 


h = self. G n(N, h, padded message) 
N len — [0] ” 64 
N len[63] = (len(last) * 8) & Üxff 
N_len[62] = (len(last) * 8) >> 8 
N — self. AddModulo(N, N len) 
Sigma = self.  AddModulo(Sigma, padded message) 
return (h, N, Sigma) 
def digest( self, message, out=512 ): 


return list2str ( 


def GetHash(self, message, 


N = [0] * 
Sigma = [ 
if out 

h = [0] 
elif out 

hc 
else: 


[0x01] 


64 

0] 64 
512: 

x 64 
256: 
x 64 


self.GetHash ( 


str2list( message ), 


out=512, no padeFalse): 


print("Nrong hash out length!") 


N 512 - [ 
N 5121621 


Smyshlyaev, e 


0] * 64 
= 0x02 


t al. 


# 512 = 


0x200 
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length bits = len(message) ” 8 


length = len(message) 
i = 0 
asd = message[::-1] 


while (length bits >= 512): 
tmp = (messageli * 64: (i + 1) ” 64])[::-1] 
h = self. G n(N, h, tmp) 
N = self. AddModulo(N, N 512) 
Sigma = self.  AddModulo(Sigma, tmp) 


length_bits -= 512 

i+= 1 
last = (message[i * 64: length]) [::-1] 
if (len(last) == 0 and no_pad): 

pass 
else: 


h, N, Sigma = self. Padding(last, N, h, Sigma) 


N 0 = [0] ” 64 
h = self. G n(N 0, h, N) 
h = self G n(N.0, h, Sigma) 
if out == 512: 
return h[::-1] 
elif out == 256: 
return (h[0:32])[::-1] 


def hash(self, str message, out-512, no pad-False): 
return list2str(self.GetHash(str2list(str message), out, no pad)) 


def H256 (msg): 
S = Stribog() 
return S.hash(msg, out=256) 


def H512 (msg): 
S = Stribog() 
return S.hash(msg) 


def num2le( s, n ): 
res — we 
for i in range(n): 
res += chr(s & OxFF) 
S >>= 8 
return res 
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def le2num( s ): 


res = 0 
for i in range(len(s) - 1, -1, -1): 
res = (res << 8) + ord(s[il) 


return res 


def XGCD(a,b): 

"""XGCD(a,b) returns a list of form [g,x,yl, where g is GCD(a,b) and 

x,y satisfy the equation g € ax + by.""" 

al=1; bl=0; a2=0; b2=1; aneg-1; bneg-1; swap = False 

if(a < 0): 

a = -a; aneg--1 

if(b < 0): 

b = -b, bneg--1 
if(b > a): 

swap = True 

[a,b] = [b,a] 
while (1): 

quot = -(a / b) 


al = al + quot”a2, bl = bl + quot*b2 
if(a == 0): 
if (swap): 
return [b, b2*bneg, a2*aneg] 
else: 
return [b, a2*aneg, b2*bneg] 
quot = -(b / a) 


a2 = a2 + quot*al; b2 € b2 + quot”bl 
if(b == 0): 
if (swap): 
return la, bl”bneg, al”anegl 
else: 
return la, al*aneg, bl”bnegl 


def getMultByMask( elems, mask ): 
n = len( elems ) 
r = 1 
for i in range( n ): 
if mask & 1: 
r *= elems[ n- 1- i] 
mask = mask >> 1 
return r 
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def subF(P, other, p): 
return (P - other) $ p 


def divF(P, other, p): 
return mulF(P, invF (other, p), p) 


def addF(P, other, p): 
return (P + other) $ p 


def mulF(P, other, p): 
return (P * other) $ p 


def invF(R, p): 
assert (R != 0) 
return XGCD(R, p)[1] % p 


def negF(R, p): 
return (-R) $ p 


def povF(R, m, p): 
assert R 1— None 
assert type(m) in (int, long) 


if m == 
assert R !- 0 
return 1 

elif m « 0: 
t — invF(R, p) 


return powF(t, (-m), p) 
else: 

i = m.bit length() - 1 

r = 1 


while i > 0: 


if (m >> i) & 1: 
r= (r * R) sep 
r= (r * r) Sp 
i -= 1 
if m8 1: 
r= (r * R) Sp 
return r 
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def add(Px, Py, 


Ox, 


Oy, p, a, 


if Ox == Oy == None: 


return [Px, 


if PX Py 
return İQx, 


if (Px ox) 
return [None, 


if (Px == Ox) 
assert Py != 


return duplicate (Px, 


else: 
1 = divF ( 
resX = subF ( 
resY = subF ( 
return [resX, 


def duplicate(Px, 
if (Px == None) 
return [None, 


if Py == 0: 
return [None, 


Se 
resX = 
resY = 
return [resX, 


Smyshlyaev, 


and 


and 


subF ( 
subF ( powF ( 
mulF( 1, 


divF (addF (mulF (powF (Px, 
subF (powF (1, 2, 
subF (mulF (1, 
resy] 


et al. 


Py] 


None: 
Qy] 


(Py 
None] 


(Py 


Qy, Py, p 


resy] 
Py; yay: 


and 
None] 


None] 


p), 
SubF (Px, 


negF (Oy, 


Ly ES D ), 
subF ( 


SESPAKE 


b): 


p)): 


Py, p, a) 


), subF( Ox, 
Px, 


Px, resX, p 


(Py == None): 


2, p), 3, p 


), 
mulF(Px, 2, p) 
p) 


resX, p), 


Informational 


Px, p), p) 
p), Ox, p 
), p), Py, 
a, p), 

, p) 

, Py, p) 
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def mul(Px, Py, s, p, a, b): 
assert type(s) in (int, long) 


assert Px != None and Py != None 
X = Px 

Y = Py 

i = s.bit_length() - 1 


resX = None 
resY = None 
while i 5 0: 
if (s >> i) & 1: 
resX, resY = add(resX, resY, X, Y, p, a, b) 
resX, resY — duplicate(resX, resY, p, a) 
i -= 1 
if s & 1: 
resX, resY — add(resX, resY, X, Y, p, a, b) 
return [resX, resy] 


def Ord(Px, Py, m, g, P, a, b): 


assert Px != None and Py != None 

assert (m != None) and (q != None) 

assert mul(Px, Py, m, p, a, b) == [None, None] 
X = Px 

Y = Py 

r=m 


for mask in range(1 << len(q)): 
t = getMultByMask(q, mask) 
Rx, Ry = mul(X, Y, t, p, a, b) 
if (Rx == None) and (Ry == None): 
r — min(r, t) 
return r 


def isQuadraticResidue( R, p ): 
if R == 
assert False 
temp = powF(R, ((p - 1) / 2), p) 
if temp == (p — 1): 
return False 
else: 
assert temp == 1 
return True 
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def getRandomQuadraticNonresidue (p): 
from random import randint 


r = (randint(2, p - 1)) $ p 
while isOuadraticResidue (r, p): 
r = (randint(2, p - 1)) $ p 


return r 


def ModSqrt( R, p ): 
assert R != None 
assert isOuadraticResidue (R, p) 


if p 6 4 == 3: 
res = povF(R, (p + 1) / 4, p) 
if powF(res, 2, p) != R: 
res = None 
return [res, negF(res, p)l 
else: 
ainvF = invF(R, p) 


s=p-1 

alpha = 

while (s $ 2) == 0: 
= 1 


b = powF (getRandomQuadraticNonresidue(p), s, p) 
r = povF(R, (s + 1) / 2, p) 


bj = 1 

for k in range(0, alpha — 1): if alpha >= 2 because p % 4 = 1 
d = 2 ** (alpha - k — 2) 
x = powF (mulF (powF (mulF (bj, r, p), 2, p), ainvF, p), d, p) 
if x 1— 1: 

bj — mulF(bj, povF(b, (2 %% k), p), p) 
res — mulF(bj, r, p) 
return [res, negF(res, p)l 
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def generateQs( p, pByteSize, a, b, m, q, orderDivisors, 
assert pByteSize in ( 256 / 8, 512 / 8 ) 
PxBytes = num2le( Px, pByteSize ) 
PyBytes = num2le( Py, pByteSize ) 
Qs € 11 
S = [] 
Hash src = [] 
Hash res = [] 
co factor = m / g 
seed = 0 
while len( Qs ) !=N: 
hashSrc = PxBytes + PyBytes + num2le( seed, 4 ) 
if pByteSize == ( 256 / 8 ): 
QxBytes € H256( hashSrc ) 
else: 
QxBytes — H512( hashSrc ) 
Ox = le2num( OxBytes ) $ p 
R = addF( addF( powF (Ox, 3, p ), mulF (0x, a, p), p), 
if ( R == ) or ( not isQuadraticResidue( R, p ) ): 
seed += 1 
continue 
Oy sart = ModSgrt( R, p ) 
Oy = min (Oy sart) 
if co factor % Ord(Qx, Oy, m, orderDivisors, p, a, 
seed += 1 
continue 
Qs += [ (Ox, Oil 
S += [seed] 
Hash src += [hashSrc] 
Hash_res += [QxBytes] 
seed += 1 
return Qs, S, Hash src, Hash res 
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if name == " main ": 


SESPAKE March 2017 


for i, curve in enumerate(curvesParams): 


print "Asl." x sStrECQbrl) +14 
if "3410-2012-256-paramSetA" 


Curve " + curve["OID"] 
in curve["OID"] or A 


"3410-2012-512-paramSetC" in curve["OID"]: 


Q, S, Hash src, Hash res — 


generateQs(curvel"p"1,N 


curvel"n"1,N 
curvel"a"1,N 
curvel"b"1,N 
curvel"m"1,N 
curve["q"],N 
[ 2, 2, curve["q"]], 
curvel"x"1,N 
curve["y"],\ 


1) 
else: 
Q, S, Hash src, Hash res = 


generateQs(curvel"p"1,N 


curvel"n"1,N 
curvel"a"1,N 
curvel"b"1,N 
curvel"m"1,N 
curve["q"],N 
[curve["q"]], A 
curve ["x"],\ 
curve["y"],\ 


1) 


jue 

for g, s, hash src, hash res 
print "Point Q " + str(j) 
j += 1 


print "X=", hex(q[0]) [:-1] 
print "Y=", hex(q[1])[:-1] 


print "SEED=","{0:#0{1}x}" 
print 


in zip(Q, S, Hash src, Hash res): 


.format (s,6) 
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